Is memecoin-claims-now.netlify.app safe? TrustSniffer's low-trust assessment: 25/100

Overview

This hostname sits in the shared subdomain space of the Netlify hosting platform. When analysed, it served only the platform's default "Site not found" 404 page, with no branding, products, contact details or other content. The name itself, "memecoin claims now", uses the urgent, claim-oriented wording common to crypto token-claim and airdrop campaigns. The page shows no monetisation or business model, so its apparent purpose cannot be established from visible content alone.

Scam/Impersonation Risk

Contradictory signals are present, and they are material. Several independent threat-intelligence sources currently flag this hostname as malicious or suspicious, and an external blacklist listing is confirmed. That is decisive for the risk posture. Behavioural testing found concealed forms on a page that visibly shows only an error message. They appeared in every test run and included password-type input. The page also underwent very large structural changes after interaction, and its network activity was almost entirely directed to external destinations. A final-destination mismatch was also flagged. Together these indicate that the visible error page may be a placeholder or decoy, and that content or credential-capture functionality may be injected dynamically. The domain's name also resembles the hosting platform's own brand name. That resemblance is most likely an artefact of the shared subdomain structure, so it is not treated as confirmed impersonation. No conflicting legal identities and no phishing-page content were observed, so the concern rests on the blacklist status and the concealed-form behaviour. The domain is extremely new, which strengthens that concern. Evidence:

• Homepage, threat reputation: 3 engines rated the hostname malicious and 1 suspicious. A separate external blacklist listing is also recorded.
• Homepage, behavioural sandbox: hidden forms, including password-type fields, appeared in 3 of 3 runs. About 4,130 DOM mutations occurred after interaction, and a maximum of 99.6% of requests went to external hosts.
• Domain provenance: about 14 days old (0.04 years). The web archive holds only 2 snapshots, spanning 2026-10-06 to 2026-10-07.

Regulatory Verification Notes

The site presents no legal, terms, privacy, about or contact pages. It names no operating entity, claims no licence or registration, and states no jurisdiction. Operator ownership is opaque, and the on-page disclosure position is unclear. This is ownership opacity, not an identity contradiction, because no conflicting legal entities appear. The absence of regulatory disclosure is a verification gap in its own right. In this case it sits alongside confirmed adverse reputation signals, which raises its weight. A third-party broker-reputation dataset returned no match for this hostname, which is neutral context rather than a regulatory finding. The valid organisation-validated TLS certificate identifies the hosting platform as the certificate subject, not the operator of this site. It therefore says nothing about who runs the site. Evidence:

• Entire site: no legal-entity name, licence number, registry reference or contact channel on the only page captured, the 404 page.
• Transport encryption: certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV), subject organisation Netlify, Inc, valid to 2027-03-19.
• Hosting infrastructure: served from AS16509 (AMAZON-02 - Amazon.com, Inc., US).

What to Verify Next

Anyone who reached this hostname through a message, advertisement, social post or QR code should trace that source and treat it as unconfirmed. Any real memecoin or token claim should be located by typing the project's official domain directly, taken from its established documentation or from the exchange or wallet provider's own listing. A claim link should not be accepted just because it carries an urgent message. Anyone who has already connected a wallet or signed a transaction through this hostname should review and revoke token approvals promptly. Anyone who entered credentials should change them. The hosting platform's abuse process is the appropriate reporting route. The reference ID the platform prints on its error page can be quoted in that report. Evidence:

• Homepage: the page carries no content, only the platform's own error text, so no claim, project or operator is identified.
• Hostname: the name alone asserts an urgent claim offer. No supporting project, token or issuer is named anywhere on the site.
• Homepage, behavioural sandbox: concealed forms with password-type fields were present despite the page showing none.

Summary Verdict

The overall posture is elevated risk. Confirmed adverse third-party reputation, concealed form behaviour and a very new, unattributed domain converge into a consistent picture. Standard technical hygiene on the hostname does not outweigh that picture. The site cannot be treated as legitimate on the available evidence, and its operator remains unidentified.

Infrastructure Integrity

The hostname resolves only to Amazon-hosted edge addresses behind a protective CDN/WAF layer, and the origin server was not observable. This is a mitigating factor only and does not establish legitimacy. Edge-only visibility also prevents independent verification of the true host and can mask rapid content swaps. That is relevant here, given the dynamic page behaviour noted above. Two abuse reports exist against one of the shared edge addresses, but they relate to a common provider address used by many tenants. They carry no confidence weighting and are discounted as indicators against this specific site.

Closing Assessment

This site should not be used for login, credential entry, wallet connection, transaction signing or any financial interaction. At most, it may be examined passively from an isolated environment. Any claim, airdrop or token offer that led here should be pursued only through independently confirmed official channels.

Signals weighed against the site

• AbuseIPDB: 2 reports on hosting IP 2a05:d014:58f:6200::259 (Amazon Data Services Ireland Ltd, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.